Research program in computer and network security

计算机与网络安全研究计划

• 批准号: 327318-2006
• 负责人: McHugh, John
• 金额: $ 2.62万
• 依托单位: Dalhousie University
• 依托单位国家: 加拿大
• 项目类别: Discovery Grants Program - Individual
• 财政年份: 2006
• 资助国家: 加拿大
• 起止时间: 2006-01-01 至 2007-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=337894
• 关键词: Research; program; computer; network; security

This proposal describes a program of research in Computer and Network security to be carried out at Dalhousie University under the auspices of the newly established Privacy and Security Laboratory. The proposed program covers both observational and experimental studies.  Over the years, the internet has grown to the point that it exhibits emergent behaviors, i.e. aggregate phenomena that cannot be predicted from the behaviors of the individual systems or groupings of individual systems from which it is composed.  These manifest themselves in a variety of ways, including the collapse of parts of the core routing structure during scanning worm outbreaks, and a highly visible disturbance of an otherwise power law connection statistic by a relatively small pool of machines infected with the Welchia-B worm.  By aggregating and analyzing massive amounts of network data, we develop global situational awareness of the network that allows us to place local observations in perspective. At the same time, the defense of individual enterprises and systems requires local detection and defense measures.  There have been a few attempts at performing evaluations of defensive mechanisms such as Intrusion Detection Systems, but these have been largely unsatisfactory for a number of reasons.  The second major thrust of the proposed research plan is the creation of an isolated test facility that can be used for a variety of projects involving malicious code such as worms and for exploring new ways to both detect and mitigate attacks on end systems and networks. This test facility will also support research projects in a number of related areas, including the generation of realistic background traffic for use in security testing, and better techniques for evaluating intrusion detection and prevention systems.  It can also serve as a dedicated simulation or emulation facility to explore selected aspects of network behavior for larger networks. The program also provides opportunities for the training of both researchers and practitioners in computer security practices.

该提案描述了计算机和网络安全的研究计划将在新成立的隐私和安全实验室的主持下在达尔豪西大学进行。该计划涵盖了观测和实验研究。多年来，互联网已经发展到它表现出涌现行为的地步，即无法从组成它的单个系统或单个系统的行为中预测的聚合现象。这些表现在各种方式中，包括扫描蠕虫爆发期间部分核心路由结构的崩溃，以及由感染Welchia的相对较小的机器池对其他幂律连接统计的高度可见的干扰，B蠕虫。通过聚合和分析大量的网络数据，我们开发了网络的全局态势感知，使我们能够正确地进行本地观察。同时，单个企业和系统的防御需要本地检测和防御措施。已经有一些尝试对防御机制进行评估，例如入侵检测系统，但是，由于种种原因，这些研究在很大程度上都不能令人满意。拟议中的研究计划的第二个主要目标是建立一个可用于各种项目的孤立的试验设施涉及诸如蠕虫的恶意代码，以及探索检测和减轻对终端系统和网络的攻击的新方法。该测试设施还将支持许多相关领域的研究项目，包括生成用于安全测试的真实背景流量，以及评估入侵检测和防御系统的更好技术，它还可以作为专用模拟或仿真设施，探索大型网络的网络行为的某些方面。该计划还为计算机安全实践的研究人员和从业人员提供培训机会。